kubernetes-sigs
Unable to make multiple webhook-enabled controller deployments
In Crossplane, we have a single webhook server for core Crossplane controllers and an arbitrary number of webhooks deployed by the provider controllers. All of those are usual controller-runtime controllers and webhooks.
However, the generated ValidatingWebhookConfiguration and MutatingWebhookConfiguration files have static hard-coded names, which means that when we install one or more providers, they override the original configuration that was installed for Crossplane itself. So, the providers and Crossplane fight over a single object.
We could either add a new field to the webhook marker or derive the name from somewhere smart enough that it will differentiate one another.
I'd be willing to contribute the change if we can come to a solution/workaround.
@muvaf Does this mean that it's actually not possible to install two controller managers that a) are built with kubebuilder/controller-tools, and b) use webhooks? That does seem like a problem.
@negz That's what I can tell. There might be some point during the deployment of the controller where the names of these resources are patched but I couldn't find it. This is an example project referenced from the kubebuilder book.
The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.
This bot triages issues and PRs according to the following rules:
- After 90d of inactivity,
lifecycle/staleis applied - After 30d of inactivity since
lifecycle/stalewas applied,lifecycle/rottenis applied - After 30d of inactivity since
lifecycle/rottenwas applied, the issue is closed
You can:
- Mark this issue or PR as fresh with
/remove-lifecycle stale - Mark this issue or PR as rotten with
/lifecycle rotten - Close this issue or PR with
/close - Offer to help out with Issue Triage
Please send feedback to sig-contributor-experience at kubernetes/community.
/lifecycle stale
However, the generated ValidatingWebhookConfiguration and MutatingWebhookConfiguration files have static hard-coded names, which means that when we install one or more providers, they override the original configuration that was installed for Crossplane itself. So, the providers and Crossplane fight over a single object.
@muvaf Not at all. Take this sample project in Kubebuilder as an example:
Although the ValidatingWebhookConfiguration and MutatingWebhookConfiguration YAMLs generated by controller-tools have names mutating-webhook-configuration and validating-webhook-configuration (see), but it has kustomize namePrefix which should be the project name (see).
So when you make deploy, which actually executes $(KUSTOMIZE) build config/default | kubectl apply -f -, kustomize will generate names of the real webhook YAMLs as <project-name>-mutating-webhook-configuration and <project-name>-validating-webhook-configuration.
Unless you have two different services of webhook configurations in a same project scaffolded by Kubebuilder, that is not supported by controller-tools.
The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.
This bot triages issues and PRs according to the following rules:
- After 90d of inactivity,
lifecycle/staleis applied - After 30d of inactivity since
lifecycle/stalewas applied,lifecycle/rottenis applied - After 30d of inactivity since
lifecycle/rottenwas applied, the issue is closed
You can:
- Mark this issue or PR as fresh with
/remove-lifecycle stale - Mark this issue or PR as rotten with
/lifecycle rotten - Close this issue or PR with
/close - Offer to help out with Issue Triage
Please send feedback to sig-contributor-experience at kubernetes/community.
/lifecycle stale
The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.
This bot triages issues and PRs according to the following rules:
- After 90d of inactivity,
lifecycle/staleis applied - After 30d of inactivity since
lifecycle/stalewas applied,lifecycle/rottenis applied - After 30d of inactivity since
lifecycle/rottenwas applied, the issue is closed
You can:
- Mark this issue or PR as fresh with
/remove-lifecycle rotten - Close this issue or PR with
/close - Offer to help out with Issue Triage
Please send feedback to sig-contributor-experience at kubernetes/community.
/lifecycle rotten
The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.
This bot triages issues according to the following rules:
- After 90d of inactivity,
lifecycle/staleis applied - After 30d of inactivity since
lifecycle/stalewas applied,lifecycle/rottenis applied - After 30d of inactivity since
lifecycle/rottenwas applied, the issue is closed
You can:
- Reopen this issue with
/reopen - Mark this issue as fresh with
/remove-lifecycle rotten - Offer to help out with Issue Triage
Please send feedback to sig-contributor-experience at kubernetes/community.
/close not-planned
@k8s-triage-robot: Closing this issue, marking it as "Not Planned".
In response to this:
The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.
This bot triages issues according to the following rules:
- After 90d of inactivity,
lifecycle/staleis applied- After 30d of inactivity since
lifecycle/stalewas applied,lifecycle/rottenis applied- After 30d of inactivity since
lifecycle/rottenwas applied, the issue is closedYou can:
- Reopen this issue with
/reopen- Mark this issue as fresh with
/remove-lifecycle rotten- Offer to help out with Issue Triage
Please send feedback to sig-contributor-experience at kubernetes/community.
/close not-planned
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.
